semgrep

Parallel static analysis scanner with automatic language detection, Pro cross-file taint tracking, and merged SARIF output. Run a Semgrep scan with automatic language detection, parallel execution via Task subagents, and merged SARIF output. All scan results, SARIF files, and temporary data are stored in a single output directory. In both cases, always create the directory with mkdir -p before writing any files. The output directory is resolved once at the start of Step 1 and used throughout all subsequent steps. Required: Semgrep CLI ( semgrep --version ). If not installed, see Semgrep installation docs . Optional: Semgrep Pro — enables cross-file taint tracking, inter-procedural analysis, and additional languages (Apex, C#, Elixir).